feat(core): extract HTTP router and add output-safety primitives

Foundation layer for the repo-config and isolated-workflow-runner work that
follows in this stack. No behaviour change to dispatch or the pipeline.

- Extract the fetch handler out of `src/app.ts` into `src/http-router.ts`,
  so route wiring is testable without booting the server process.
- Add `src/utils/bot-identity.ts` and `src/utils/github-actor.ts` to give the
  bot a single identity/actor resolution point instead of scattered literals.
- Add `src/utils/exact-credential-redaction.ts` and widen the redaction paths
  in `src/utils/log-redaction.ts`.
- Add `src/mcp/servers/inline-comment-dedup.ts` so repeated inline review
  comments collapse instead of stacking on re-runs.
- Add `src/db/postgres-error.ts` to classify Postgres failures at one place.
- Extend the LLM output scanner and sanitizer coverage.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUPpJPtxAaHWrBsjytRGyM

Author: chrisleekr

docs/build/conventions.md

@@ -78,14 +78,15 @@ bun run check
 
 ## CI pipeline
 
-Four workflow files form the pipeline; each owns one responsibility.
+Five pipeline files; each owns one responsibility.
 
 | Workflow                               | Trigger                                                   | Owns                                                                                                                                                                                                                               |
 | -------------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `.github/workflows/ci.yml`             | `pull_request` + `push: main` + `workflow_call`           | Quality gates only: typecheck, lint, format, audit:ci, test, build                                                                                                                                                                 |
 | `.github/workflows/secrets-scan.yml`   | `push: branches-ignore: [gh-pages]` + `workflow_dispatch` | Standalone gitleaks scan, decoupled so every push (incl. chore/docs) is gated                                                                                                                                                      |
 | `.github/workflows/release-please.yml` | `push: [main, beta]`                                      | release-please maintains a Release PR per branch; merging it cuts the release then calls `docker-build.yml`, and on a stable `main` release dispatches `github-app-released` to `chrisleekr/helm-charts` to open the chart-sync PR |
-| `.github/workflows/docker-build.yml`   | `workflow_call` + `workflow_dispatch`                     | Reusable image builder: matrix split-and-merge (amd64 on `ubuntu-24.04`, arm64 on `ubuntu-24.04-arm`), Trivy scan                                                                                                                  |
+| `.github/workflows/docker-build.yml`   | `workflow_call` + `workflow_dispatch`                     | Reusable image builder: matrix split-and-merge (amd64 on `ubuntu-24.04`, arm64 on `ubuntu-24.04-arm`), Trivy scan. Tags each variant `<version>-<variant>` plus a mutable `latest-<variant>` on prod releases                      |
+| `.gitlab-ci.yml`                       | every branch (gates) + `main` (images)                    | GitLab CI: the same quality gates on every branch, then `latest-orchestrator` / `latest-daemon` to the GitLab container registry on `main`                                                                                         |
 
 Notes:
 

docs/build/extending.md

@@ -4,7 +4,7 @@ Two extension points in this codebase: workflow handlers and MCP servers. Both f
 
 ## Adding a workflow
 
-A workflow is a verb the bot performs on a target (issue or PR). Six are registered today; adding a seventh is appending one entry to `src/workflows/registry.ts` plus a handler file.
+A workflow is a verb the bot performs on a target (issue or PR). Seven are registered today; adding an eighth is appending one entry to `src/workflows/registry.ts` plus a handler file.
 
 ### Step 1: write the handler
 
@@ -25,14 +25,15 @@ export type WorkflowHandler = (ctx: WorkflowRunContext) => Promise<HandlerResult
 | `logger`                        | `pino.Logger`                                  | Structured logging.                           |
 | `octokit`                       | `Octokit`                                      | API client with installation token.           |
 | `deliveryId`                    | string \| null                                 | Webhook delivery id for tracing.              |
-| `daemonId`                      | string                                         | Daemon process id.                            |
+| `daemonId`                      | string                                         | Stable isolated-runner identity.              |
 | `setState(state, humanMessage)` | function                                       | Persist partial state mid-execution.          |
 
 `HandlerResult` is a discriminated union:
 
 ```typescript
 | { status: "succeeded"; state: unknown; humanMessage?: string }
 | { status: "failed"; reason: string; state?: unknown; humanMessage?: string }
+| { status: "incomplete"; reason: string; state?: unknown; humanMessage?: string }
 | { status: "handed-off"; state?: unknown; humanMessage?: string; childRunId: string }
 ```
 
@@ -70,7 +71,7 @@ If the workflow should be reachable via mentions, extend the system prompt in `s
 
 ### Step 4: document and test
 
-- Add `docs/use/workflows/<name>.md` matching the template used by the six built-ins.
+- Add `docs/use/workflows/<name>.md` matching the template used by the seven built-ins.
 - Add `test/workflows/handlers/<name>.test.ts` covering the happy path and one failure mode. Integration via `test/workflows/dispatcher.test.ts` is automatic: if the registry entry is valid, dispatch works.
 - The `check:docs-sync` script in CI fails any PR that touches `src/workflows/**` without updating the workflow docs tree.
 
@@ -201,4 +202,4 @@ If your extension reacts to a GitHub event the bot does not yet handle (e.g. `pu
 2. **Add a webhook handler** in `src/webhook/events/<event>.ts` that parses the payload and dispatches via `dispatchByLabel` (label path) or `dispatchByIntent` (comment path). Webhook handlers must return within 10 s, fire `processRequest` with fire-and-forget semantics.
 3. **Register the event handler** in `src/app.ts` alongside the existing `app.webhooks.on(...)` calls.
 
-Webhook handlers do **not** run business logic, they parse the event, build a `BotContext`, and dispatch. All bot work happens in workflow handlers, called from the daemon.
+Webhook handlers do **not** run business logic, they parse the event, build a `BotContext`, and dispatch. Structured workflow handlers execute in one-attempt runner Pods. Legacy direct and scoped jobs execute on shared daemons.

docs/index.md

@@ -5,7 +5,7 @@ hide:
 
 # GitHub App
 
-A GitHub App that responds to `@chrisleekr-bot` mentions on pull requests and issues, powered by the Claude Agent SDK. Every webhook is acknowledged in under ten seconds and handed to the daemon fleet over WebSocket; when triage flags the job as heavy or the queue backs up, the orchestrator spawns an ephemeral daemon Pod on Kubernetes so the same image scales on demand.
+A GitHub App that responds to `@chrisleekr-bot` mentions on pull requests and issues, powered by the Claude Agent SDK. Every webhook is acknowledged in under ten seconds. Structured workflows run in one-attempt Kubernetes Pods; legacy direct and scoped jobs use the shared daemon fleet, which can add ephemeral Pods for heavy work or queue overflow.
 
 ## Three doors
 

docs/operate/github-app.md

@@ -30,7 +30,7 @@ Direct link: <https://github.com/settings/apps/new>.
 | SSL verification | Enabled (default, keep it).                                        |
 | Webhook secret   | Output of `openssl rand -hex 32`. Save as `GITHUB_WEBHOOK_SECRET`. |
 
-The path `/api/github` is set by `pathPrefix` in `createNodeMiddleware` (`src/app.ts`). Don't change the path unless you also change the source.
+The path `/api/github/webhooks` is the `WEBHOOK_PATH` constant in `src/http-router.ts`, passed as the `path` option to `createWebMiddleware` in `src/app.ts`. The router matches it explicitly before delegating, so changing it means changing both. Don't change the path unless you also change the source.
 
 For local dev, set the Webhook URL to a [smee.io](https://smee.io) channel and relay it to your local server:
 

src/ai/llm-client.ts

@@ -143,7 +143,7 @@ export interface LLMCreateParams {
   readonly messages: readonly LLMMessage[];
   /** Hard upper bound on generated tokens; prevents runaway cost on malformed responses. */
   readonly maxTokens: number;
-  /** Optional temperature; default 0 for classification determinism. */
+  /** Passed through only when set. Claude 5 models reject the field. */
   readonly temperature?: number;
 }
 
@@ -329,7 +329,10 @@ export function buildRequest(
     model: p.model,
     max_tokens: p.maxTokens,
     messages: p.messages.map((m) => ({ role: m.role, content: m.content })),
-    temperature: p.temperature ?? 0,
+    // Only sent when a caller asks for it. Claude 5 models reject the field
+    // outright ("`temperature` is deprecated for this model", 400), so
+    // defaulting it here made every single-turn call fail against them.
+    ...(p.temperature !== undefined ? { temperature: p.temperature } : {}),
   };
   if (system !== undefined) base["system"] = system;
   return base;
@@ -345,7 +348,10 @@ export function buildRichRequest(
     model: p.model,
     max_tokens: p.maxTokens,
     messages: p.messages.map((m) => ({ role: m.role, content: m.content })),
-    temperature: p.temperature ?? 0,
+    // Only sent when a caller asks for it. Claude 5 models reject the field
+    // outright ("`temperature` is deprecated for this model", 400), so
+    // defaulting it here made every single-turn call fail against them.
+    ...(p.temperature !== undefined ? { temperature: p.temperature } : {}),
   };
   if (system !== undefined) base["system"] = system;
   if (p.tools !== undefined && p.tools.length > 0) {

src/app-log-fields.ts

@@ -31,6 +31,7 @@ export const HTTP_LOG_EVENTS = {
   schedulerRunRejectedPayload: "http.scheduler.run.rejected_payload",
   schedulerRunEnqueued: "http.scheduler.run.enqueued",
   schedulerRunFailed: "http.scheduler.run.failed",
+  requestFailed: "http.request.failed",
 } as const;
 
 /**
@@ -135,6 +136,19 @@ export const HttpLogFieldsSchema = z.discriminatedUnion("event", [
       err: z.unknown(),
     })
     .strict(),
+  /**
+   * Error: the request router itself threw, caught by the `Bun.serve` `error`
+   * hook. Distinct from `schedulerRunFailed`, which is one endpoint's own catch:
+   * this is the last-resort boundary for any route. Carries no request data, an
+   * unhandled throw may have been triggered by attacker-shaped input, so only
+   * the secret-scrubbed `err` is recorded.
+   */
+  z
+    .object({
+      event: z.literal(HTTP_LOG_EVENTS.requestFailed),
+      err: z.unknown(),
+    })
+    .strict(),
 ]);
 
 export type HttpLogFields = z.infer<typeof HttpLogFieldsSchema>;